Short answer
The deployed build has no Firebase API key, or the wrong one. Add the key to your host’s production environment variables using the prefix your framework exposes to the browser (VITE_ for Vite, NEXT_PUBLIC_ for Next.js, EXPO_PUBLIC_ for Expo), then rebuild and redeploy, since the value is baked in at build time. Copy it from the web app’s config in the Firebase console.
Why the live build has no valid key
01
The variable isn’t set on the host
“Thrown if the provided API key is invalid. Please check that you have copied it correctly from the Firebase Console.” Firebase, firebase.auth.Error
Firebase’s reference says to check you copied the key correctly, and a missing variable is the usual way that goes wrong: your .env file isn’t deployed. Add the same variables in Vercel, Netlify, EAS or your host’s settings for the production environment, not only for previews, then trigger a new build.
02
The variable has the wrong prefix
“Variables prefixed with VITE_ will be exposed in client-side source code after Vite bundling.” Vite, Env variables and modes
Bundlers only put variables with their public prefix into browser code. A Vite app reading FIREBASE_API_KEY gets undefined; it needs VITE_FIREBASE_API_KEY and globalThis._importMeta_.env.VITE_FIREBASE_API_KEY. Next.js uses NEXT_PUBLIC_ and Expo uses EXPO_PUBLIC_.
03
The value is mangled or from another project
Quote marks, a trailing space or a line break pasted into the host’s settings make the key invalid. So does a key from a dev Firebase project paired with production’s other config values. Copy the whole firebaseConfig for the right project and app.
04
Don’t hide the key: it’s public by design
“API keys restricted to Firebase services do not need to be treated as secrets, and it's safe to include them in your code or configuration files.” Firebase, Learn about using and managing API keys for Firebase
Some builders hide the key, or leave it out, because it looks like a secret. Firebase’s web API key is meant to ship in the app; your data is protected by Security Rules and App Check, so put the rules right instead of hiding the key.
Checked against the vendor’s docs on : Firebase reference: firebase.auth.Error; Firebase docs: API keys for Firebase; Vite docs: Env variables and modes.
Rather hand it over?
Fixed scope, fixed price, paid upfront. The work happens in writing; no call needed.
- from $450App Fix TicketOne reproducible bug in an existing mobile or web app, diagnosed and fixed.See scope and start
- from $450AI-Built App RescueA Lovable, Bolt or Cursor app checked end to end in 3 days, then its worst problems fixed at a fixed price.No issues worth fixing, no charge. If the Launch Check finds nothing rated medium or higher, Simon refunds the full $450. You keep the report either way.See scope and start
Related: Vercel environment variables undefined · Firebase No Firebase App [DEFAULT] has been created · Firebase auth/unauthorized-domain · Firebase phone auth invalid-app-credential